OpenClaw versions older than 2026.3.31 contain a concurrency control flaw in the public LINE webhook handler. The missing shared pre‑authentication concurrency budget allows an attacker to send a high volume of concurrent requests before the webhook’s signature verification step occurs, depleting the application’s ability to process legitimate messages. This flaw is a classic resource exhaustion vulnerability (CWE‑799) and results in transient availability loss for the affected service.

The vulnerability affects any OpenClaw installation running a version prior to 2026.3.31. The exposed surface is the LINE webhook endpoint, an unprotected public URL that accepts HTTP requests without prior authentication. Any deployment of the affected OpenClaw product that exposes this endpoint to the internet is therefore susceptible.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1 % suggests that the likelihood of automated exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by flooding the webhook endpoint with concurrent requests without requiring any credentials. Successful exploitation results in denial of service, disrupting all upstream services that rely on the LINE webhook. No elevation or data theft is possible; the impact is limited to availability.